A Chief Information Security Officer (CISO) is evaluating two mutually exclusive risk resp… — CompTIA Security+

A Chief Information Security Officer (CISO) is evaluating two mutually exclusive risk response proposals for an enterprise cloud platform with an estimated Asset Value ( $AV$ ) of $\$2,500,000$ . Threat intelligence and historical logs establish an baseline Annual Rate of Occurrence ( $ARO$ ) of $0.40$ and an Exposure Factor ( $EF$ ) of $0.30$ .

- Proposal 1 (Risk Mitigation): Deploy automated microsegmentation and advanced web application defense controls costing $\$65,000$ annually. This control reduces the $EF$ to $0.10$ and decreases the $ARO$ to $0.15$ .
- Proposal 2 (Risk Transference): Procure a cybersecurity insurance policy costing $\$50,000$ annually with a $\$100,000$ deductible per incident. The policy covers all loss exceeding the deductible per event, effectively capping the Single Loss Expectancy ( $SLE$ ) at $\$100,000$ , while leaving the $ARO$ at $0.40$ .

Based on quantitative risk analysis, which proposal delivers the maximum net annual financial benefit (gross annual risk reduction minus implementation cost), and what is that net financial benefit value?

Proposal 2, with a net annual financial benefit of $\$210,000$ .Answer
B
Proposal 1, with a net annual financial benefit of $\$197,500$ .
C
Proposal 1, with a net annual financial benefit of $\$262,500$ .
D
Proposal 2, with a net annual financial benefit of $\$260,000$ .

Answer

Proposal 2 delivers the maximum net annual financial benefit of

\$210,000

The baseline (inherent) Annual Loss Expectancy (

ALE

) is calculated as

AV \times EF \times ARO = \$2,500,000 \times 0.30 \times 0.40 = \$300,000

. For Proposal 1, the new

ALE

(\$2,500,000 \times 0.10) \times 0.15 = \$37,500

, providing a gross risk reduction of

\$262,500

. After subtracting the

\$65,000

control cost, the net financial benefit is

\$197,500

. For Proposal 2, the insurance caps the single loss to the deductible of

\$100,000

, resulting in a new

ALE

\$100,000 \times 0.40 = \$40,000

, which gives a gross risk reduction of

\$260,000

. Subtracting the

\$50,000

premium yields a net financial benefit of

\$210,000

. Thus, Proposal 2 delivers the maximum net annual benefit.

Step-by-Step Solution

Calculate the Inherent Annual Loss Expectancy (ALE) prior to implementing any response.

Inherent

SLE = AV \times EF = \$2,500,000 \times 0.30 = \$750,000

. Inherent

ALE = SLE \times ARO = \$750,000 \times 0.40 = \$300,000

Establishing the baseline ALE is required to measure gross risk reduction.

Calculate the residual ALE, gross risk reduction, and net financial benefit for Proposal 1 (Mitigation).

Proposal 1

SLE = \$2,500,000 \times 0.10 = \$250,000

. Residual

ALE_1 = \$250,000 \times 0.15 = \$37,500

. Gross Risk Reduction =

\$300,000 - \$37,500 = \$262,500

. Net Financial Benefit =

\$262,500 - \$65,000 = \$197,500

Evaluates the financial efficiency of the technical safeguard controls.

Calculate the residual ALE, gross risk reduction, and net financial benefit for Proposal 2 (Transference).

Under Proposal 2, capped

SLE = \$100,000

(deductible). Residual

ALE_2 = \$100,000 \times 0.40 = \$40,000

. Gross Risk Reduction =

\$300,000 - \$40,000 = \$260,000

. Net Financial Benefit =

\$260,000 - \$50,000 = \$210,000

Evaluates the financial efficiency of risk transference via insurance.

Compare net financial benefits to determine the optimal strategy.

Proposal 2 Net Benefit (

\$\$210,000

) > Proposal 1 Net Benefit (

\$\$197,500

). Proposal 2 is superior by

\$12,500

annually.

Quantitative decision making selects the strategy yielding maximum net cost savings.

Key Concept

Quantitative Risk Analysis & Cost-Benefit Analysis of Risk Responses

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic